HDD GURU FORUMS
http://forum.hddguru.com/

Unable to find Spare Area for Micron FT32G08UCM1-15
http://forum.hddguru.com/viewtopic.php?f=27&t=35915
Page 2 of 2

Author:  bos [ October 17th, 2017, 11:23 ]
Post subject:  Re: Unable to find Spare Area for Micron FT32G08UCM1-15

Thanks Sasha.

May I ask what kind of magic do you use in the BCH code words, and how were these found out? Because I never managed to ECC-correct all bit faults, so my own logical image was full of errors and completely unsalvageble.

Author:  HaQue [ October 17th, 2017, 12:01 ]
Post subject:  Re: Unable to find Spare Area for Micron FT32G08UCM1-15

I am guessing the general principal and some examples were found out by the engineers collectively, from backgrounds in flash, electronic engineering, forensics etc, and maybe access to things like SDK's or even proprietary info when flash was a little younger. And in the lab they could apply the knowledge to move forward and figure out other schemes. maybe some used services like chipworks to reverse engineer, I don't know.

This is a primer on ECC http://processors.wiki.ti.com/index.php/Raw_NAND_ECC I haven't delved into the algos, but I have always assumed they were not that complex for flash, being for error correction the algo would be fairly standard, and as not for security, probably not in-learnable. Indeed this doc http://www.cypress.com/file/203021/download states:
Quote:
Conclusion
Hamming based block codes are the most commonly used ECC for SLC NAND. Hamming codes are relatively
straightforward and simple to be implemented in either software or hardware. The disadvantage of Hamming
codes is its limited error correction capabilities, with two bit errors detection and only one bit error correction.
Therefore, it is mainly used in SLC NAND flash applications.
Reed-Solomon and BCH are able to handle multiple errors. Both codes are powerful and able to handle both
random and burst errors. Reed-Solomon code is a subset of the BCH. However, BCH is simpler than Reed-
Solomon to decode and implement.

and this page has an excel BCH calculator down the bottom if you want to get into the weeds. https://community.cypress.com/docs/DOC-9263 I am sure implementations differ between vendors too.
The magic in userland is basically : " I will try "x" in this case because in case "abc" we used "x" and it worked. I will try "y" and "z" modifications to "x" because in other cases, these were the variables that changed.

Author:  arvika [ October 17th, 2017, 15:17 ]
Post subject:  Re: Unable to find Spare Area for Micron FT32G08UCM1-15

BCH is very simple. Here you can find some basic information and mathematical formula: https://en.wikipedia.org/wiki/BCH_code
;)

Author:  Sasha Sheremetov [ October 17th, 2017, 16:29 ]
Post subject:  Re: Unable to find Spare Area for Micron FT32G08UCM1-15

Haha, yeah, as Arvika pointed out BCH codes are very simple :D
Especially when you have built-in decoder in VNR.
Infact in VNR for the end used the whole formula is pretty simple.
Usually codeword = Data area chunk + Spare area chunk + ECC area chunk.
Where DA+SA = payload; ECC = parity.
In BCH element you have several codewords depending on how many DA chunks you have in page.
Payload and parity positions are just relative offsets of each area from 0 which is beginning of page (consider page as vector of bits or in other words horizontal line of bits/bytes as we see in bitmap).
Polynomial is a coefficients of the formula, usually same for one vendor.
Inv/Rotation are specific settings of ECC code (you have to brute force them, usually just 4 combinations of flags which is easy).

We will add one sweeet feature for unknown/new BCH code analysis for the specified (or all!) Galois field with variable boundaries of areas.

Right now the biggest challenge is scrambled parity area but still doable for most of cases.

Author:  Sasha Sheremetov [ October 17th, 2017, 16:34 ]
Post subject:  Re: Unable to find Spare Area for Micron FT32G08UCM1-15

bos wrote:
Because I never managed to ECC-correct all bit faults, so my own logical image was full of errors and completely unsalvageble.


Make sure that you turn power ON on BCH (activate ECC correction) element before saving data/image!

Author:  bos [ October 17th, 2017, 16:36 ]
Post subject:  Re: Unable to find Spare Area for Micron FT32G08UCM1-15

I did, but the ECC-map was way more red than green, meaning I failed miserably on something on the way. I'm just not sure what :D

Author:  Sasha Sheremetov [ October 17th, 2017, 16:51 ]
Post subject:  Re: Unable to find Spare Area for Micron FT32G08UCM1-15

Are we still talking about this tablet's dump?
If so, I tested BCH and it was green.
You just need to skip first 10-20 blocks with FW they not protected by ECC so appears as red (one square element in ECC map is one page usually (or one codeword, depends..).
Scroll down to the middle of dump and check 5-10 blocks/places.

Author:  HaQue [ October 17th, 2017, 18:42 ]
Post subject:  Re: Unable to find Spare Area for Micron FT32G08UCM1-15

definitions of "simple" vary :-) !!!

Author:  bos [ October 18th, 2017, 7:20 ]
Post subject:  Re: Unable to find Spare Area for Micron FT32G08UCM1-15

Sasha Sheremetov wrote:
Are we still talking about this tablet's dump?
If so, I tested BCH and it was green.

Yes.

The thing is, when I clicked the yellow lamp in BCH elements, I only found 2 matches in one codeword, while in your case you have a lot of codewords. That's why I was asking "May I ask what kind of magic do you use in the BCH code words, and how were these found out?" earlier, because I couldn't figure out how or even what you did in that step.

Here's when I click the bulb:
Attachment:
bch.png
bch.png [ 14.46 KiB | Viewed 12292 times ]



Here's your codewords:
Attachment:
bch2.png
bch2.png [ 8.97 KiB | Viewed 12292 times ]

Author:  Sasha Sheremetov [ October 18th, 2017, 18:24 ]
Post subject:  Re: Unable to find Spare Area for Micron FT32G08UCM1-15

Ah I got it.
The BCH element works very flexible (yeah, unlike in other tools!) so you have two modes - manual and automatic.
I made completely new BCH code for your device manually so you have it in BCH element as a formula.
Now if you save a code as file and place it into BCHcodewords folder autodetection will find it (most likely) when you run it next time.
There's a button in BCH codewords editor - save/load.

Page 2 of 2 All times are UTC - 5 hours [ DST ]
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
http://www.phpbb.com/